pefile.cpp

分析PE文件的导入导出表 能够把一个exe内部的内容读出来

// PEFile.cpp : Defines the entry point for the console application.
//

#include "stdafx.h"
#include "PEFile.h"
#include <afxdlgs.h>


CMyApp theApp;
BOOL CMyApp::InitInstance()
{
	CFileDialog dlg(TRUE);
	if(dlg.DoModal()!=IDOK)
		return FALSE;
}

HANDLE hFile=::CreateFile(dlg.GetFileName(),GENERIC_READ,
						  FILE_SHARE_READ,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL);
if (hFile== INVALID_HANDLE_VALUE)
{
	MessageBox(NULL,"无效条件！"ValidPE",MB_OK);

}
IMAGE_DOS_HEADER dosHeader;
IMAGE_NT_HEADER32 ntHeader;

BOOL bValid = FALSE;
DWORD dwRead;
::ReadFile(hFile,&dosHeader,sizeof(dosHeader),&dwRead,NULL);
if(dwRead == sizeof(dosHeader))
{
	if(dosHeader.e_magic == IMAGE_DOS_SIGATURE)
	{
		if(::SetFilePoint(hFile,dosHeader.e_lfanew,NULL,FILE_BEGIN)!=-1)
		{
			::ReadFile(hFile,&ntHeader,sizeof(ntHeader),&dwRead,NULL);
			if(dwRead == sizeof(ntHeader))
			{
				if(ntHeader.Signature == IMAGE_NT_SIGNATURE)
					bValid = TRUE;
			}
		}
	}
}
			if(bValid)
				MessageBox();
			else
				MessageBox();
			::CloseHandle(hFile);
			return FALSE;